An already difficult week for cybersecurity deteriorated further as Chinese hackers spied on thousands more companies following a breach at IT management and remote access leader ConnectWise.
Security researchers at Microsoft say state-aligned Chinese hackers infiltrated ConnectWise’s cloud backup service, appropriating application credentials essential for establishing data connections between ConnectWise and its corporate clientele, who depend on this service for their data backups.
With these stolen credentials, the attackers gained unauthorized entry into customer Microsoft-hosted environments, allowing them to access emails and other files as legitimate users.
According to Microsoft, the hackers deployed AI agents to swiftly compromise approximately 2,250 organizations, executing nearly 3,000 attempted sign-ins every minute. This unprecedented speed, Microsoft noted, provides defenders with “little time to detect and respond.”
The remarkable pace of these mass-hacks was attributed to the utilization of AI agents, particularly ARTEX, an open-source AI framework designed to collaborate with AI models for stress-testing cyber defenses. This identical AI software was previously employed in a compromise targeting South Korea’s financial systems, many of which exhibited inadequate security and lacked multi-factor authentication.
ConnectWise announced it has suspended access to its cloud backup system and is currently investigating the breach. The company stated on Thursday that efforts were underway to restore the service.